Mehulkumar Savajani
@MsavajaniCompletionist
5 followers477 downloads1,508 copies62 likes18,115 views
97 detections
Filters
Last updated
All Time
Detection languages
80
11
6
Categories
24
23
17
16
14
Platforms
53
16
13
12
6
Products / Services
24
9
8
7
6
MITRE Techniques
28
27
26
21
20
This rule detects when a system configuration file is downloaded from a FortiGate device within 60 seconds of a successful SSO login from the same user and source IP. This rapid sequence of events is indicative of automated scripts used by attackers to exfiltrate device configurations immediately after gaining initial access.
Detects the execution of the Microsoft Build Engine (msbuild.exe) with a project file (.proj) located in a suspicious, non-standard directory such as C:\ProgramData. This is a known "Living off the Land" technique (T1127.001) used by adversaries, including the PHALT#BLYX campaign, to proxy code execution through a trusted binary and evade defenses.
This rule detects the creation of a local administrative account on a FortiGate device with a generic name commonly used by threat actors for persistence following an initial compromise. The rule specifically looks for log events indicating the addition of a new system administrator account with names like 'secadmin', 'itadmin', 'support', 'backup', 'remoteadmin', or 'audit'.
This rule detects suspicious activity related to mailbox access within Office 365. It has two main parts: 1) Identifies users accessing a high number of unique mailboxes belonging to other users. 2) Identifies users accessing a high number of unique folders within another user's mailbox. Both scenarios can indicate unauthorized access, data exfiltration attempts, or compromised accounts.
This rule detects suspicious activity related to mailbox access within Office 365. It has two main parts: 1) Identifies users accessing a high number of distinct mailboxes belonging to other users. 2) Identifies users accessing a high number of distinct folders within another user's mailbox. Both parts are designed to flag potential unauthorized access, data exfiltration, or reconnaissance activities within an Exchange Online environment.
This rule detects successful sign-ins that used single-factor authentication and were flagged by Azure AD Identity Protection for having unfamiliar properties, such as a new location, device, or ASN. Single-factor authentication is inherently weaker, and when combined with anomalous sign-in properties, it can be an indicator of a compromised account.
This detection identifies the creation of an Internet Shortcut (.url) file in a user's Startup folder. This is a persistence mechanism (T1547.001) used by adversaries like the PHALT#BLYX campaign, which created a .url file pointing to a local executable using the 'file:///' protocol to launch malware at logon. The rule specifically looks for the creation of '.url' files in the Startup folder and includes a filter for a known IOC ('DeleteApp.url') from the PHALT#BLYX campaign, as well as excluding common legitimate processes like web browsers and explorer.exe as initiating processes.
Detects PowerShell commands used to add exclusions to Windows Defender or disable real-time monitoring. This is a known defense evasion technique (T1562.001) used by adversaries, including the PHALT#BLYX campaign, to allow malicious components to operate without being detected.
This detection identifies outbound network traffic to domains, IP addresses, or a specific port known to be associated with the PHALT#BLYX campaign's infrastructure. The campaign uses these for malware delivery and DCRat command and control (C2). The rule specifically looks for connections to known malicious IPs or domains, or connections on port 3535 (used by DCRat) originating from processes associated with the malware (staxs.exe, tybd7.exe, aspnet_compiler.exe).
Detects the execution of AutoHotKey (.ahk) or AutoIt (.au3) scripts from common staging directories such as C:\Users\Public\ or C:\Temp\. This is a known technique used by malware like DarkGate to stage and execute its payload.
Page 3 of 10